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DETAILED ACTION 

1 . This action is in response to the application filed on 2/27/2002. 

2. Claims 1-20 are under examination. 

Claim Objections 

Claim 14 is objected to because of the following informalities: 
Claim 14 contains improper dependency. Correction is claim 14 depend on claim 13. 

Claim Rejections - 35 USC § 102 
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

3. Claims 1, 2, 5, 6, 13, 14 and 15 are rejected under 35 U.S.C. 102(e) as being 
anticipated by Wagner (US Patent 6,085,224). 

As per claim 1 . Wagner discloses: 
intercepting said message before any content of said message is processed by said 
server [col. 4 lines 16-18 "an interceptor for intercepting a datastream (i.e. 
message) before the datastream is received by an application program"]; 
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examining said message to determine if it contains one or more unauthorized elements 
[col. 4 lines 18-20 "a scanner for scanning (i.e. examining) the intercepted 
datastream to detect a trigger event(i.e. unauthorized elements) in the intercepted 
datastream"]; 

if it is determined that said message contains an unauthorized element preventing said 
message received from being processed by said server [col. 2 lines 58-59 "If such 
receipt has not been authorized (i.e. unauthorized), the file is not passed to the 
application program"]; 

if it is determined that said message does not contain an unauthorized element allowing 
said message received to be processed by said server [Fig. 5 if NO trigger event (56) 
(i.e. not contain an unauthorized element) then pass to application program(86)]. 

As per claim 2 , the rejection of claim 1 is incorporated and further 

Wagner: 

if it is determined that said message received contains an unauthorized element, 
preventing said message received from being processed by said server, and causing an 
error notification to be sent to said user [col. 4 lines 20-22 "an event response 
generator for generating a response to the detected trigger event in 
correspondence with event configuration data, col. 4 lines 60-61 "an alert is 
provided to the user"]. 
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As per claim 5 , it is rejected for the same reason set forth in the rejection 
of claim 1 above. 

As per claim 6 , the rejection of claim 5 is incorporated and is rejected for 
the same reason set forth in the rejection of claim 2 above. 

As per claim 13 , it is an apparatus claim corresponds to a method claim 1 
and is rejected for the same reason set forth in the rejection of claim 1 above. 

As per claim 14 , the rejection of claim 13 is incorporated and further 
Wagner teaches: 

network server comprises an Internet network server and said message is received over 
the Internet by said server from a user [col. 7 lines 47-49 "A browser typically 
communicates datastreams with servers (i.e. Internet network server) using the 
HTTP protocol over an open network such as the Internet"]. 

As per claim 15 , the rejection of claim 13 or 14 is incorporated and further 
Wagner teaches: 

returning an error message to said user [col. 4 line 60 "an alert is provided to the 
user"]. 
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Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in section 
102 of this title, if the differences between the subject matter sought to be patented and the prior art are such that the 
subject matter as a whole would have been obvious at the time the invention was made to a person having ordinary skill 
in the art to which said subject matter pertains. Patentability shall not be negatived by the manner in which the 
invention was made. 

4. Claims 3, 4, 7-9, 16 and 17 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Wagner (US Patent No. 6,085,224) and in view of Schoening (US 
Patent No. 6,226,788). 

As per claim 3 , the rejection of claim 1 is incorporated and further Wagner 

discloses: 

examining said message received by said server [col. 4 lines 18-20 "a scanner for 
scanning (i.e. examining) the intercepted datastream to detect a trigger event(i.e. 
unauthorized elements) in the intercepted datastream"]; 

determining if said message received by said server contains an unauthorized element 
[col. 2 lines 58-59 "If such receipt has not been authorized (i.e. unauthorized), the 
file is not passed to the application program"]; 

preventing a said message received containing an unauthorized element from being 
processed by said server [col. 2 lines 58-59 "If such receipt has not been 
authorized (i.e. unauthorized), the file is not passed to the application program"]; 
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Wagner doesn't clearly teach that receive identification of an execution 
program for processing the message and retrieving identification of all message types 
associated with the execution program set. 

However, Schoening teaches that receive identification of an execution 
program for processing the message [col. 4 lines 20-23 "each functional unit 
comprising at least one executable program component that is associated with a 
device", "(A) obtaining a device identifier from the device' 1 ] and retrieving 
identification of all message types associated with the execution program [col. 26 lines 
18-20 ""sweeps" the managed network 100 to retrieve information that identifies 
users, hosts, and other networking information", col.4 lines 26-28 "mapping at 
least one of the executable program components to an overriding executable 
program component in association with the device identifier"]. 
Therefore, it would have been obvious to a person of ordinary skill in the art at the time 
the invention was made to incorporate the teaching of Schoening into the teaching of 
Wagner to use identification of the execution program for processing the message and 
to retrieve the identification of all message type associated with the execution program. 
The modification would be obvious because one of ordinary skill in the art would be 
motivated to provide automated management of new or different kinds of devices (i.e. 
messages) and also provide integration (i.e. mapping between message and execution 
program [Schoening, col. 3 lines 4-5,7-9]. 
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As per claim 4 , the rejection of claim 3 is incorporated and further Wagner 

disclose: 

if it is determined that said message received contains an unauthorized element, 
causing an error notification to be sent to said user [col. 4 lines 20-22 "an event 
response generator for generating a response to the detected trigger event in 
correspondence with event configuration data, col 4 lines 60-61 "an alert is 
provided to the user" Fig. 5]. 

As per claim 7 , it encompasses limitations that are similar to limitations of 
claim 3. Thus, it is rejected with the same rationale applied against claim 3 above. 

As per claim 8 , the rejection of claim 7 is incorporated and is rejected for 
the same reason set forth in the rejection of claim 4 above. 

As per claim 9 , the rejection of claim 8 is incorporated and further Wagner 

teaches: 

if it is determined that said message received does not contain an unauthorized 
element, allowing said message received to be processed by said server [Fig. 5 if NO 
trigger event (56) (i.e. not contain an unauthorized element) then pass to 
application program (86)]. 
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As per claim 16 . the rejection of claim 15 is incorporated and further claim 
16 is an apparatus claim corresponds to a method claim 3 and is rejected for the same 
reason set forth in the rejection of claim 3 above. 

As per claim 17 . the rejection of claim 16 is incorporated and is rejected 
for the same reason set forth in the rejection of claim 9 above. 

5. Claims 10, 11 and 12 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Wagner (US Patent No. 6,085,224) and in view of Brown et al (US Patent No. 
6,397,225). 

As per claim 10 , the rejection of claim 1 is incorporated and Wagner 
doesn't clearly teaches that message comprises a name-value pair. 

However, Brown teaches that message comprises a name-value pair [col. 
5 lines 9-10 "the message 300 includes a command 305 followed by a name-value 
pairs 310 and a terminator 320 Fig. 3"] 

Therefore, it would have been obvious to a person of ordinary skill in the 
art at the time the invention was made to incorporate the teaching of Brown into the 
teaching of Wagner to include a name value pairs into the message. The modification 
would be obvious because one of ordinary skill in the art would be motivated to have 
name value pairs into the message so that type of the variable may be derived directly 
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from the format of the value [Brown, col. 5 lines 30-31], also this format of message 
overcoming or at least reducing the latency problem [Brown, col. 2 lines 34-36]. 

As per claim 11 , the rejection of claim 10 is incorporated and further 
Wagner teaches: 

element comprises one or more of the following items: an instruction, a command, a 
character, a parameter, a token, or a string of any of said previous items [col. 2 lines 
26-29 "the HTML file (i.e. message) also contains data and/or commands which 
may not be displayed at the browser" "This "hidden" data and/or commands", 
Abst. lines 6-7 "datastream for trigger events, such as cookie data, script 
commands, and applet programs"]. 

As per claim 12 , the rejection of claim 11 is incorporated and further 
Wagner teaches: 

element is interpretable as art instruction or command by said server[A6sf. lines 6-7 
"datastream for trigger events, such as cookie data, script commands, and applet 
programs"]. 
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6. Claims 18, 19 and 20 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Wagner (US Patent No. 6,085,224) in view of Schoening (US Patent No. 
6,226,788) and further in view of Brown et al (US Patent No. 6,397,225). 

As per claim 18 . the rejection of claim 17 is incorporated and Wagner and 
Schoening don't teach that message comprises a name-value pair and element is 
contained by said name-value pair. 

However, Brown teaches that message comprises a name-value pair 
[page 3 paragraph 0032 "the HTTP request is mapped to name/value pairs and 
packed into a subject-based message"]. 

Therefore, it would have been obvious to a person of ordinary skill in the 
art at the time the invention was made to incorporate the teaching of Brown into the 
teaching of Wagner and Schoening to include a name value pairs into the message. 
The modification would be obvious because one of ordinary skill in the art would be 
motivated to have name value pairs into the message so that type of the variable may 
be derived directly from the format of the value [Brown, col. 5 lines 30-31], also this 
format of message overcoming or at least reducing the latency problem [Brown, col. 2 
lines 34-36]. 
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As per claim 19 . the rejection of claim 18 is incorporated and further 
Wagner teaches: 

element comprises one or more of the following items: an instruction, a command, a 
character, a parameter, a token, or a string of any of said previous items [Abst. lines 6- 
7 "datastream for trigger events, such as cookie data, script commands, and 
applet programs"]. 

As per claim 20 , the rejection of claim 19 is incorporated and further 
Wagner teaches: 

element is interpretable as an instruction or command by said server [Abst. lines 6-7 
"trigger events, such as cookie data, script commands, and applet programs"]. 
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Conclusion 

7. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

Gryaznov et al (US 6,748,534) discloses that a system and a method for 
performing partitioned scanning of a dataset for malware in a distributed computing 
environment is disclosed. A dataset is maintained in a plurality of structured databases 
in the distributed computing environment. 

Chen et al (US 5,832,208) discloses that a software agent for detecting 
and removing computer viruses located in attachments to e-mail messages. A client- 
server computer network includes a server computer and a plurality of client computers. 

Kim et al (US 6,701,440) discloses that a system and method for a remote 
or network-based application service offering virus scanning, sniffing, or detecting of e- 
mail viruses prior to the e-mail messages arriving at the destination system or server 
are disclosed. 

Raanan et al (US 6,311,278) discloses that a method and computer 
program for automatically and continually extracting application protocols (i.e., defining 
a set of allowable or authorized actions) for any application. 

Humes (US 5,996,01 1) discloses that a system and method for restricting 
access to data received by a computer over a network by filtering certain data from the 
data received. 

Braddy (US 6,141,759) discloses that a system and method are disclosed 
for distributing, monitoring and managing information requests on a computer network 
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including one or more client computer systems, a first server computer system, and one 
or more secondary server computer systems. 

Sidles (US 2002/0062342) discloses that a system automatically 
intercepts and responds to most requests for personal information that are received 
from a network and directed to a user. Such requests are intercepted, and the sources 
of the requests, as well as the user, are validated. 

Any inquiry concerning this communication or earlier communications 
from the examiner should be directed to Nirav Patel whose telephone number is 571- 
272-5936. The examiner can normally be reached on 8 am - 4:30 pm (M-F). 

If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, Kim Vu can be reached on 571-272-3859. The fax phone 
number for the organization where this application or proceeding is assigned is 703- 
872-9306. 
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